Strategy
Make governed card data a product every team, and every partner, can trust.
The north star: a new co-brand partner reaches its first governed report in days, not quarters, with program, purpose and column rules enforced by the database and nothing partner-shaped copied out of the bank.
Treat data as a product: owned, contracted, discoverable and held to an SLA, not a pile of tables behind a ticket queue.
Entitlements are the platform, not a feature. Program scope, purpose, masking and logging are designed in from day one.
A new partner goes live in days because the controls are reused, not rebuilt for each program.
Every model answers to a monitored business outcome and an SR 26-2 materiality tier, or it does not ship.
Build or buy
Row policies, column masking and audit are commodity: Immuta, Databricks Unity Catalog and Snowflake Horizon all provide them. What an issuer cannot buy is its co-brand semantics. The recommendation: buy the policy engine, build the partner layer, and keep it small enough to review. Positioning here is qualitative; no vendor pricing is quoted.
Policy orchestration across several engines. Strongest when the estate mixes Snowflake, Databricks and a warehouse. The partner model, purposes and audit semantics are still yours to define.
Row filters and masking native to the platform, on the existing bill. The natural default for a single-engine estate, with the same gap: partner scope and purpose are your semantics.
Program scope as a row dimension, purpose as an access dimension, aggregate-only partner grants with suppression, masking bound to purpose, and a self-test. A few hundred lines of reviewed SQL on top of either engine.
The unit that matters: the marginal cost of partner N+1
An issuer with a large co-brand book onboards partners again and again. The case for a governed layer is that each new partner becomes configuration rather than a build, while the reviewed control surface stays the same size. No dollar figures are claimed.
| Per new partner | Bespoke extract | Governed domain (Atlas) |
|---|---|---|
| Data plumbing | New pipelines and a partner-shaped copy of the data | No copies: one program code on existing products |
| Row and column controls | Re-implemented and re-reviewed for each extract | One persona and its grants; the same policies apply unchanged |
| Security review | A new surface to review, and the extract keeps leaking after hand-off | The reviewed surface stays constant; the self-test gates go-live |
| Ongoing liability | Every extract is standing cardholder data with its own lifecycle | Revoke the persona and nothing partner-shaped remains to clean up |
- Data plumbing
Bespoke: New pipelines and a partner-shaped copy of the data
Atlas: No copies: one program code on existing products
- Row and column controls
Bespoke: Re-implemented and re-reviewed for each extract
Atlas: One persona and its grants; the same policies apply unchanged
- Security review
Bespoke: A new surface to review, and the extract keeps leaking after hand-off
Atlas: The reviewed surface stays constant; the self-test gates go-live
- Ongoing liability
Bespoke: Every extract is standing cardholder data with its own lifecycle
Atlas: Revoke the persona and nothing partner-shaped remains to clean up
Roadmap
“Now” is what this product already does. “Next” and “Later” are the plan.
Shipped and running in this product
Program scope, purpose grants and column masking enforced by Postgres on every read path: the simulator, the API and the AI analyst.
The partner receives contracted metrics by contracted dimensions; any cell under 25 cardholders is suppressed.
Plain-English questions compile through a semantic layer onto masked views. Verified questions cost no model call.
Every read is hash-chained; one call re-verifies the whole chain.
One to two quarters
Replace persona switching with SSO and SCIM identity, with signed claims read by the same policies.
Request, approve and auto-expire a 15-minute unmask grant, with every step logged.
Partner users sign in to their contracted metrics, with the contract clause behind every tile.
Self-serve and deeper sharing
Overlap and attribution analysis across both parties without either side seeing rows.
Location and residency as policy attributes for offshore and affiliate access.
Materiality-tiered validation cadence for every model that feeds a card decision.